KCSA (Kubernetes and Cloud Native Security Associate): Complete Exam Cheat Sheet

The KCSA (Kubernetes and Cloud Native Security Associate) certification helps learners build a strong foundation in securing Kubernetes and cloud native environments. This cheat sheet highlights the key areas of the exam, including the 4Cs security model, cluster and workload hardening, identity and access management, network segmentation, secrets handling, policy enforcement, and supply chain security.

It serves as a quick reference guide to review essential security concepts, common misconfigurations, and recommended practices to strengthen your Kubernetes security posture during your preparation.

1) Cloud-Native Security Fundamentals

• 4Cs Security Model (Defense in Depth): security is applied across four layers:Cloud (infrastructure), Cluster (Kubernetes control plane + nodes), Container (runtime + images), and Code (application security).
• Cloud Workload Protection Platform (CWPP): protects workloads across cloud and on-prem environments, helping defend container workloads from malware and vulnerability exploits.
• Shared Responsibility Model (Managed Kubernetes): in managed services (e.g., EKS-style services), the provider typically manages the control plane, while the customer remains responsible for workloads, data protection, IAM, network controls/policies, and worker node security configuration.

2) Kubernetes Architecture and Components

Control Plane Components

• kube-apiserver: front-end that exposes the Kubernetes API.
• etcd: key-value store for cluster configuration and state.
• kube-scheduler: selects nodes for Pods based on constraints and availability.
• kube-controller-manager: runs controllers that reconcile actual state to desired state.
• cloud-controller-manager: integrates cloud-specific control logic (where applicable).

Worker Node Components

• kubelet: node agent ensuring Pods/containers run as expected.
• kube-proxy: maintains networking rules for Pod communication.
• Container Runtime: runs containers (e.g., containerd, CRI-O).

Controllers (Examples)

• Deployment Controller: manages rollouts/rollbacks.
• Job Controller: manages run-to-completion tasks.
• Namespace Controller: helps with namespace lifecycle/resource cleanup.

Static Pods

• Static Pods are managed directly by the kubelet on a node and bypass scheduling.

3) Component Hardening and Security Settings

• kube-scheduler security: disable profiling (--profiling) to reduce attack surface; secure scheduler kubeconfig permissions (example: 600).
• kubelet security: disable anonymous authentication; use TLS certificate and private key configuration for secure HTTPS serving.
• Node Authorizer: ensures a kubelet can access only the Pods and related objects (e.g., Secrets, ConfigMaps) assigned to that node.
• Kubeconfig default path: ~/.kube/config is the commonly used default location.

4) Workload Isolation and Sandboxing

• Container sandboxing: creates a stronger boundary between the container and host kernel to reduce container breakout risk (escaping from container to host).

gVisor vs Firecracker

• gVisor: software-based isolation via syscall handling in user space; useful for tighter isolation in shared/multi-tenant environments.
• Firecracker: microVM-based isolation using KVM hardware virtualization; strong isolation with fast startup (often associated with serverless/FaaS patterns).
• RuntimeClass: when multiple runtimes are available, specify the runtime per workload using runtimeClassName in the Pod spec.

5) Image and Supply Chain Security

• Multi-stage builds: use multiple FROM stages to separate build-time tooling from runtime, producing smaller and cleaner images.
• Image signing: helps confirm integrity (not modified) and authenticity (trusted publisher) using digital signatures and public keys.
• Build attestations: build-time metadata describing:
• SBOM: what’s inside the image (components/dependencies).
• Provenance: how the image was built (build origin/history).
• Pipeline attestation: cryptographic proof that an artifact was produced via a trusted CI/CD pipeline and passed defined security gates.

Analysis types

• Static code analysis: checks source code to detect flaws early (code layer).

6) Access Control and Identity (RBAC)

RBAC building blocks

• Roles: namespace-scoped permissions.
• ClusterRoles: cluster-wide permissions.
• RoleBindings / ClusterRoleBindings: attach permissions to users, groups, or service accounts.
• RBAC verbs: get, list, watch, create, update, patch, delete (and related actions).
• Important nuance: a ClusterRole bound with a RoleBinding applies only within that namespace.
• system:masters group: extremely privileged — avoid using certificates tied to it for daily work.
• Authentication: Kubernetes supports JWT and OIDC; other methods (like LDAP) usually require an authenticating proxy or webhook.

7) Network and Data Security

• NetworkPolicies: control Ingress and Egress traffic between Pods; enforcement depends on the CNI.
• CNIs like Calico and Cilium enforce NetworkPolicies.
• CNIs like Flannel typically do not enforce them.

Secrets vs ConfigMaps

• ConfigMaps: non-sensitive configuration in plaintext.
• Secrets: stored as Base64-encoded data encoding is not encryption.

Secrets mounting (volumes vs env vars):

• Volumes are generally safer than env vars (less leak-prone; better operational behavior; often memory-backed).
• Env vars can leak more easily and remain fixed for the container lifetime.
• hostNetwork: hostNetwork: true attaches a Pod to the host network—useful for certain monitoring/packet tools but increases risk if the Pod is compromised.
• Cloud metadata access risk: restrict Pod access to cloud metadata endpoints to reduce credential/infrastructure information exposure.

8) Security Standards and Policies

Pod Security Standards (PSS): Privileged, Baseline, Restricted.

Get Mahendran Selvakumar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Pod Security Admission (PSA): enforces PSS using modes:

• Enforce: blocks non-compliant Pods.
• Audit: logs violations.
• Warn: warns users.
• Admission controllers order: Mutating runs before Validating; validating webhooks allow/deny requests.
• SecurityContext: defines privilege and isolation settings (e.g., run as non-root, capability controls, AppArmor usage).
• AppArmor: can be applied at Pod/container level; container-level settings can override Pod-level settings.

9) Threat Modeling, Multi-tenancy, and Compliance

• STRIDE model: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
• MITRE ATT&CK: maps real-world attacker tactics and techniques.

Multi-tenancy:

• Soft multi-tenancy: trusted tenants (same org); use namespaces, quotas, RBAC, policies, and network controls for fair sharing and guardrails.
• Hard multi-tenancy: untrusted tenants (e.g., SaaS customers); stronger isolation often requires separate clusters and/or sandboxed runtimes.
• PCI DSS: compliance standard for environments that store/process/transmit credit card data.

10) Monitoring and Auditing

Audit policy levels:

• None (no logs)
• Metadata (who/what/when)
• Request (includes request body)
• RequestResponse (includes request + response bodies)
• Grafana: used for querying, visualizing, and alerting across metrics, logs, and traces.
• Practical focus: strong auditing + monitoring helps detect misconfigurations, risky access patterns, and potential compromise early.

Conclusion:

The KCSA certification builds strong foundational knowledge of Kubernetes security and securing cloud native workloads. Reviewing these topics and practicing regularly will prepare you to apply security controls in real-world clusters and advance toward certifications such as CKA, CKS

Continue exploring, learning, and contributing to the cloud native community to strengthen your journey and expertise.

Keep Learning, Keep Certifying!!!

If you found this guide helpful, give it a clap 👏

For more insightful content on AWS best practices, cloud security, devops and technology updates, don’t forget to “Follow me”

Feel free to reach out to me, if you have any other queries or suggestions

Stay connected on Linkedin https://www.linkedin.com/in/mahendran-selvakumar-36444a77/